mirror of
https://github.com/crewAIInc/crewAI.git
synced 2026-09-23 03:11:05 +00:00
0f6e499df5
Two review findings. - Loading the project's .env (so `crewai eval` asks the AMP the run was traced to) also let a project's .env choose where the saved bearer token goes. The request still follows the project's CREWAI_PLUS_URL, because that is how a self-hosted project is wired and the run really is there, but the credential now goes only to an origin this machine is logged in to: `crewai enterprise configure`'s saved settings, an address already exported in this shell (read before .env is loaded), or app.crewai.com. Anywhere else the run is read anonymously and the command says so, naming `crewai enterprise configure`. The wider hole is not this command's: `crewai run` sends the same token to the same .env-chosen URL, and that is worth a separate look. - saved_login() caught every exception and returned None, so an unreadable credential store — a rotated key, a directory left owned by root — read as "anonymous", quietly spending the run's one anonymous read and then refusing a user who believes they are logged in. Only AuthError means anonymous now; anything else is reported with its cause and a pointer to `crewai login`. This matches tracing_credential() in the library, which catches AuthError alone. Tests: a project pointing elsewhere is read anonymously with the message and no token; a shell-exported AMP is trusted; the configured AMP keeps the token and says nothing; the origin rule itself; AuthError versus an unreadable store. 41 passed. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>